ISO 22000

In short

ISO 22000:2018 sets out how a company in the food chain should manage food safety: leadership, planning, HACCP principles, prerequisite programmes, traceability, communication with suppliers and customers, and continual improvement. It uses the same structure as ISO 9001, so the two can be run together.

ISO publishes the standard but does not certify anyone. Certificates come from independent certification bodies, which should themselves be accredited. ISO 22000 asks the company to set its own prerequisite programmes, without prescribing them. That gap is the reason FSSC 22000 exists: it takes ISO 22000 and adds the sector prerequisites and extra requirements.

What it covers

• A documented food-safety management system with leadership commitment
• HACCP principles and operational prerequisite programmes
• Traceability, recall and emergency preparedness
• Communication along the food chain and continual improvement

What it does not cover

• It does not prescribe detailed prerequisites, so two ISO 22000 sites can differ a lot in practice
• It is not recognised by GFSI by itself, so buyers that require "a GFSI scheme" will not count it

Who asks for it

Some industrial and B2B buyers accept it, particularly where "any recognised system" is allowed. Buyers that require GFSI will ask for FSSC 22000, BRCGS, IFS Food or SQF.

How to check a certificate

Check that the certificate names an accredited certification body, the scope of the site and a valid date. Then confirm it with the certification body or through the accreditation body’s register.

How a company gets it

1. Buy the standard and run a gap assessment against ISO 22000:2018
2. Build and document the system, including prerequisite programmes
3. Choose an accredited certification body and book the stage 1 and stage 2 audits
4. Receive the certificate, then keep up annual surveillance audits

Questions